@agent-native/core 0.115.4 → 0.117.0

package/dist/db/ddl-guard.js

@@ -40,9 +40,13 @@ const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
  * This is a plain read (no lock), so it never blocks on an `ACCESS EXCLUSIVE`
  * lock the way `CREATE`/`ALTER` would.
  */
-export async function pgTableExists(table, injectedClient) {
-    if (!isPostgres() || !PLAIN_IDENTIFIER.test(table))
+export async function pgTableExists(table, injectedClient, dialectIsPostgres) {
+    // The dialect override travels with an injected client: a multi-app process
+    // (the hosted Realtime Gateway) probes a per-app Postgres DB even when its
+    // own process-global DB is absent or SQLite.
+    if (!(dialectIsPostgres ?? isPostgres()) || !PLAIN_IDENTIFIER.test(table)) {
         return false;
+    }
     const client = injectedClient ?? getDbExec();
     try {
         const { rows } = await client.execute({
@@ -95,9 +99,11 @@ export async function pgColumnExists(table, column, injectedClient) {
  * connection this can hang just like a `CREATE`/`ALTER` would; checking first
  * skips the lock on the already-migrated hot path.
  */
-export async function pgIndexExists(indexName, injectedClient) {
-    if (!isPostgres() || !PLAIN_IDENTIFIER.test(indexName))
+export async function pgIndexExists(indexName, injectedClient, dialectIsPostgres) {
+    if (!(dialectIsPostgres ?? isPostgres()) ||
+        !PLAIN_IDENTIFIER.test(indexName)) {
         return false;
+    }
     const client = injectedClient ?? getDbExec();
     try {
         const { rows } = await client.execute({
@@ -138,10 +144,14 @@ export async function pgIndexExists(indexName, injectedClient) {
  * `false` only when it already existed up front (no DDL issued).
  */
 export async function ensureSchemaObject(options) {
-    const { probe, ddl, label, lockTimeout, injectedClient } = options;
+    const { probe, ddl, label, lockTimeout, injectedClient, dialectIsPostgres } = options;
     if (await probe())
         return false;
-    const ran = await runGuardedDdl(ddl, { lockTimeout, injectedClient });
+    const ran = await runGuardedDdl(ddl, {
+        lockTimeout,
+        injectedClient,
+        dialectIsPostgres,
+    });
     if (ran)
         return true;
     // The DDL was swallowed by a lock-timeout. The object is virtually always
@@ -163,11 +173,12 @@ export async function ensureSchemaObject(options) {
  */
 export async function ensureTableExists(table, createSql, options = {}) {
     return ensureSchemaObject({
-        probe: () => pgTableExists(table, options.injectedClient),
+        probe: () => pgTableExists(table, options.injectedClient, options.dialectIsPostgres),
         ddl: createSql,
         label: `table ${table}`,
         lockTimeout: options.lockTimeout,
         injectedClient: options.injectedClient,
+        dialectIsPostgres: options.dialectIsPostgres,
     });
 }
 /**
@@ -189,11 +200,12 @@ export async function ensureColumnExists(table, column, addColumnSql, options =
  */
 export async function ensureIndexExists(indexName, createIndexSql, options = {}) {
     return ensureSchemaObject({
-        probe: () => pgIndexExists(indexName, options.injectedClient),
+        probe: () => pgIndexExists(indexName, options.injectedClient, options.dialectIsPostgres),
         ddl: createIndexSql,
         label: `index ${indexName}`,
         lockTimeout: options.lockTimeout,
         injectedClient: options.injectedClient,
+        dialectIsPostgres: options.dialectIsPostgres,
     });
 }
 /** True when an error looks like a Postgres `lock_timeout` (SQLSTATE 55P03). */
@@ -226,7 +238,7 @@ export function isLockTimeoutError(err) {
  */
 export async function runGuardedDdl(ddl, options = {}) {
     const client = options.injectedClient ?? getDbExec();
-    if (!isPostgres()) {
+    if (!(options.dialectIsPostgres ?? isPostgres())) {
         await client.execute(ddl);
         return true;
     }

package/dist/db/ddl-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"ddl-guard.js","sourceRoot":"","sources":["../../src/db/ddl-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAe,MAAM,aAAa,CAAC;AAEjE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,cAAuB;IAEvB,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,MAAM,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;qEAC0D;YAC/D,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAc,EACd,cAAuB;IAEvB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;;oBAES;YACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,cAAuB;IAEvB,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,MAAM,MAAM,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;kEACuD;YAC5D,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAWxC;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACrB,0EAA0E;IAC1E,qEAAqE;IACrE,wDAAwD;IACxD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,uEAAuE;IACvE,0EAA0E;IAC1E,oCAAoC;IACpC,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,6BAA6B;QACxE,iFAAiF,CACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,SAAiB,EACjB,OAAO,GAAsD,EAAE;IAE/D,OAAO,kBAAkB,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC;QACzD,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS,KAAK,EAAE;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,MAAc,EACd,YAAoB,EACpB,OAAO,GAAsD,EAAE;IAE/D,OAAO,kBAAkB,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;QAClE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,UAAU,KAAK,IAAI,MAAM,EAAE;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,cAAsB,EACtB,OAAO,GAAsD,EAAE;IAE/D,OAAO,kBAAkB,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;QAC7D,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,SAAS,SAAS,EAAE;QAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,GAAmD,CAAC;IACnE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,OAAO,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAAO,GAAsD,EAAE;IAE/D,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACpC,qEAAqE;gBACrE,2CAA2C;gBAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,6BAA6B,WAAW,GAAG,CAAC,CAAC;gBAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,WAAW,GAAG,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,qEAAqE;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Guards for on-demand `ensureTable()` DDL so the common already-migrated path\n * takes NO `ACCESS EXCLUSIVE` lock on Postgres.\n *\n * Lives in its own module (like `./widen-columns.js`) so stores can import it\n * without every `vi.mock(\"../db/client.js\")` test needing to stub it: the\n * helpers resolve `isPostgres()` / `getDbExec()` through `client.js`, so a test\n * that mocks the client to SQLite (`isPostgres: () => false`) makes the\n * Postgres-only existence checks no-ops automatically.\n *\n * ## Why\n *\n * `ensureTable()` runs once per process on first DB touch. In a long-lived Node\n * server the cost is paid once and is invisible. In a Netlify `-background`\n * function the process is fresh, so this is the FIRST touch — and the\n * `CREATE TABLE`/`ALTER TABLE ... ADD COLUMN` DDL it issues takes an\n * `ACCESS EXCLUSIVE` lock on the shared Neon Postgres database. Behind a\n * concurrent connection that already holds a conflicting lock, that DDL can\n * block ~indefinitely (observed >16s hangs in the bg worker vs ~1s inline).\n *\n * The tables/columns are essentially always already present in production, so\n * the DDL is redundant in the hot path. These helpers let a store cheaply check\n * `information_schema` first and only issue DDL when something is actually\n * missing — and when DDL must run, wrap it in a short `lock_timeout` so a\n * contended lock fails fast instead of hanging.\n *\n * All of this is Postgres-only behaviour gated on `isPostgres()`. On SQLite\n * (local dev) there is no such lock problem, so callers keep their existing\n * behaviour there.\n */\n\nimport { isPostgres, getDbExec, type DbExec } from \"./client.js\";\n\nconst PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n/**\n * True when running against Postgres AND the given table already exists in the\n * `public` schema. Returns `false` on SQLite (callers gate their own behaviour\n * there), for invalid identifiers, or when `information_schema` is unreadable —\n * the conservative answer \"not known to exist\" makes the caller fall through to\n * its idempotent `CREATE TABLE IF NOT EXISTS`, preserving today's behaviour.\n *\n * This is a plain read (no lock), so it never blocks on an `ACCESS EXCLUSIVE`\n * lock the way `CREATE`/`ALTER` would.\n */\nexport async function pgTableExists(\n  table: string,\n  injectedClient?: DbExec,\n): Promise<boolean> {\n  if (!isPostgres() || !PLAIN_IDENTIFIER.test(table)) return false;\n  const client = injectedClient ?? getDbExec();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT 1 FROM information_schema.tables\n            WHERE table_schema = 'public' AND table_name = ? LIMIT 1`,\n      args: [table],\n    });\n    return rows.length > 0;\n  } catch {\n    // information_schema unreadable (permissions / non-standard backend) —\n    // report \"unknown\" so the caller falls back to IF NOT EXISTS.\n    return false;\n  }\n}\n\n/**\n * True when running against Postgres AND the given column already exists on the\n * given table in the `public` schema. Returns `false` on SQLite, for invalid\n * identifiers, or when `information_schema` is unreadable.\n *\n * Plain read — no lock taken.\n */\nexport async function pgColumnExists(\n  table: string,\n  column: string,\n  injectedClient?: DbExec,\n): Promise<boolean> {\n  if (!isPostgres()) return false;\n  if (!PLAIN_IDENTIFIER.test(table) || !PLAIN_IDENTIFIER.test(column)) {\n    return false;\n  }\n  const client = injectedClient ?? getDbExec();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT 1 FROM information_schema.columns\n            WHERE table_schema = 'public' AND table_name = ? AND column_name = ?\n            LIMIT 1`,\n      args: [table, column],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * True when running against Postgres AND an index with the given name already\n * exists in the `public` schema. Returns `false` on SQLite, for invalid\n * identifiers, or when `pg_indexes` is unreadable.\n *\n * `CREATE INDEX` (without CONCURRENTLY) takes a `SHARE` lock that blocks\n * writes, so on a fresh background-worker process behind a concurrent\n * connection this can hang just like a `CREATE`/`ALTER` would; checking first\n * skips the lock on the already-migrated hot path.\n */\nexport async function pgIndexExists(\n  indexName: string,\n  injectedClient?: DbExec,\n): Promise<boolean> {\n  if (!isPostgres() || !PLAIN_IDENTIFIER.test(indexName)) return false;\n  const client = injectedClient ?? getDbExec();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT 1 FROM pg_indexes\n            WHERE schemaname = 'public' AND indexname = ? LIMIT 1`,\n      args: [indexName],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Probe → guarded-DDL → re-probe sequence for one piece of on-demand schema.\n *\n * This is the single safe primitive every `ensureTable()` should use so a\n * swallowed `lock_timeout` can NEVER poison a store's init memo with missing\n * schema. The flow:\n *\n *   1. `probe()` — cheap, lock-free existence check (pgTableExists / etc.).\n *      Already present → return `false` (nothing to do; the hot path takes NO\n *      lock).\n *   2. Missing → run `ddl` through `runGuardedDdl` (bounded `lock_timeout`).\n *      - DDL completed → return `true`.\n *      - DDL was swallowed by a lock-timeout (`runGuardedDdl` returned `false`)\n *        → RE-PROBE. A concurrent connection virtually always created the\n *        object meanwhile, so the re-probe usually now reports it present →\n *        return `true`. But if it is STILL missing, the required schema does\n *        NOT exist and we must NOT let the caller memoize success — so THROW.\n *        The caller's `_initPromise` rejects and the next call retries instead\n *        of running forever against absent schema.\n *\n * On SQLite the probe is always `false` (helpers no-op there) and the SQLite\n * branch of each store keeps its own create-then-catch behaviour, so this is a\n * Postgres-path primitive in practice. Returns `true` when the object exists\n * after this call (either pre-existing-after-timeout-race or freshly created),\n * `false` only when it already existed up front (no DDL issued).\n */\nexport async function ensureSchemaObject(options: {\n  /** Lock-free existence check; `true` ⇒ already present, skip DDL. */\n  probe: () => Promise<boolean>;\n  /** DDL to run only when `probe()` reports the object missing. */\n  ddl: string;\n  /** Human-readable name of what's being ensured, for the error message. */\n  label: string;\n  /** Forwarded to `runGuardedDdl`. */\n  lockTimeout?: string;\n  /** Injectable client for tests. */\n  injectedClient?: DbExec;\n}): Promise<boolean> {\n  const { probe, ddl, label, lockTimeout, injectedClient } = options;\n  if (await probe()) return false;\n  const ran = await runGuardedDdl(ddl, { lockTimeout, injectedClient });\n  if (ran) return true;\n  // The DDL was swallowed by a lock-timeout. The object is virtually always\n  // already correct by the time a contended boot retries (a concurrent\n  // connection created it), so re-probe before giving up.\n  if (await probe()) return true;\n  // Still missing after a swallowed timeout: do NOT memoize success with absent\n  // schema. Throw so the caller's init promise rejects and the next call\n  // retries, rather than leaving ensureTable \"initialized\" against a table/\n  // column/index that does not exist.\n  throw new Error(\n    `ensureSchemaObject: required schema \"${label}\" is still missing after a ` +\n      `lock-timed-out DDL; refusing to memoize init success. The next call will retry.`,\n  );\n}\n\n/**\n * Convenience wrapper: ensure a TABLE exists (probe via `pgTableExists`).\n * No-op-returns `false` on SQLite (probe is always false there) — callers run\n * the SQLite create on their own branch, so this is used on the Postgres path.\n */\nexport async function ensureTableExists(\n  table: string,\n  createSql: string,\n  options: { lockTimeout?: string; injectedClient?: DbExec } = {},\n): Promise<boolean> {\n  return ensureSchemaObject({\n    probe: () => pgTableExists(table, options.injectedClient),\n    ddl: createSql,\n    label: `table ${table}`,\n    lockTimeout: options.lockTimeout,\n    injectedClient: options.injectedClient,\n  });\n}\n\n/**\n * Convenience wrapper: ensure a COLUMN exists (probe via `pgColumnExists`).\n * `addColumnSql` should be the full `ALTER TABLE … ADD COLUMN IF NOT EXISTS …`.\n */\nexport async function ensureColumnExists(\n  table: string,\n  column: string,\n  addColumnSql: string,\n  options: { lockTimeout?: string; injectedClient?: DbExec } = {},\n): Promise<boolean> {\n  return ensureSchemaObject({\n    probe: () => pgColumnExists(table, column, options.injectedClient),\n    ddl: addColumnSql,\n    label: `column ${table}.${column}`,\n    lockTimeout: options.lockTimeout,\n    injectedClient: options.injectedClient,\n  });\n}\n\n/**\n * Convenience wrapper: ensure an INDEX exists (probe via `pgIndexExists`).\n * `createIndexSql` should be the full `CREATE INDEX IF NOT EXISTS <name> …`.\n */\nexport async function ensureIndexExists(\n  indexName: string,\n  createIndexSql: string,\n  options: { lockTimeout?: string; injectedClient?: DbExec } = {},\n): Promise<boolean> {\n  return ensureSchemaObject({\n    probe: () => pgIndexExists(indexName, options.injectedClient),\n    ddl: createIndexSql,\n    label: `index ${indexName}`,\n    lockTimeout: options.lockTimeout,\n    injectedClient: options.injectedClient,\n  });\n}\n\n/** True when an error looks like a Postgres `lock_timeout` (SQLSTATE 55P03). */\nexport function isLockTimeoutError(err: unknown): boolean {\n  const anyErr = err as { code?: unknown; message?: unknown } | null;\n  if (anyErr?.code === \"55P03\") return true;\n  const msg = String(anyErr?.message ?? anyErr ?? \"\");\n  return /lock[_ ]?timeout|canceling statement due to lock timeout/i.test(msg);\n}\n\n/**\n * Run a DDL statement that MUST execute (the schema is actually missing), with\n * a short `lock_timeout` so a contended `ACCESS EXCLUSIVE` lock fails fast\n * instead of hanging the whole process.\n *\n * Postgres path: wrap the DDL in an explicit transaction and set\n * `SET LOCAL lock_timeout` so the timeout is scoped to THIS transaction only\n * and reset automatically on COMMIT/ROLLBACK — it never leaks onto the pooled\n * (session-reused) connection the way a bare `SET lock_timeout` would. If the\n * DbExec has no `transaction` (shouldn't happen for Postgres, but defensively),\n * fall back to a session `SET` + `RESET` in a finally. A lock-timeout error is\n * swallowed: the table/column is virtually always already correct by the time a\n * contended boot retries, and the caller's memoization should still resolve so\n * the path isn't retried in a tight loop. Any non-lock-timeout error rethrows.\n *\n * SQLite path: no lock problem — just run the DDL directly.\n *\n * @returns `true` if the DDL ran to completion, `false` if it was skipped due to\n *          a lock-timeout (so the caller can decide whether to log).\n */\nexport async function runGuardedDdl(\n  ddl: string,\n  options: { lockTimeout?: string; injectedClient?: DbExec } = {},\n): Promise<boolean> {\n  const client = options.injectedClient ?? getDbExec();\n  if (!isPostgres()) {\n    await client.execute(ddl);\n    return true;\n  }\n\n  const lockTimeout = options.lockTimeout ?? \"3s\";\n  try {\n    if (typeof client.transaction === \"function\") {\n      await client.transaction(async (tx) => {\n        // SET LOCAL is transaction-scoped: it reverts on COMMIT/ROLLBACK and\n        // never persists on the pooled connection.\n        await tx.execute(`SET LOCAL lock_timeout = '${lockTimeout}'`);\n        await tx.execute(ddl);\n      });\n    } else {\n      // Defensive fallback: no transaction support. Use a session SET and\n      // guarantee a RESET so the timeout never leaks onto a reused connection.\n      try {\n        await client.execute(`SET lock_timeout = '${lockTimeout}'`);\n        await client.execute(ddl);\n      } finally {\n        await client.execute(`RESET lock_timeout`).catch(() => {});\n      }\n    }\n    return true;\n  } catch (err) {\n    if (isLockTimeoutError(err)) {\n      // Contended lock — the schema is virtually always already correct by now.\n      // Proceed; the caller's memoization still resolves so we don't loop.\n      return false;\n    }\n    throw err;\n  }\n}\n"]}
+{"version":3,"file":"ddl-guard.js","sourceRoot":"","sources":["../../src/db/ddl-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAe,MAAM,aAAa,CAAC;AAEjE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,cAAuB,EACvB,iBAA2B;IAE3B,4EAA4E;IAC5E,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,CAAC,CAAC,iBAAiB,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;qEAC0D;YAC/D,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAc,EACd,cAAuB;IAEvB,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;;oBAES;YACd,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,cAAuB,EACvB,iBAA2B;IAE3B,IACE,CAAC,CAAC,iBAAiB,IAAI,UAAU,EAAE,CAAC;QACpC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;kEACuD;YAC5D,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAaxC;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,GACzE,OAAO,CAAC;IACV,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACnC,WAAW;QACX,cAAc;QACd,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACrB,0EAA0E;IAC1E,qEAAqE;IACrE,wDAAwD;IACxD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,uEAAuE;IACvE,0EAA0E;IAC1E,oCAAoC;IACpC,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,6BAA6B;QACxE,iFAAiF,CACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,SAAiB,EACjB,OAAO,GAIH,EAAE;IAEN,OAAO,kBAAkB,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CACV,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC;QACzE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS,KAAK,EAAE;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,MAAc,EACd,YAAoB,EACpB,OAAO,GAAsD,EAAE;IAE/D,OAAO,kBAAkB,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC;QAClE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,UAAU,KAAK,IAAI,MAAM,EAAE;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAiB,EACjB,cAAsB,EACtB,OAAO,GAIH,EAAE;IAEN,OAAO,kBAAkB,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CACV,aAAa,CACX,SAAS,EACT,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,iBAAiB,CAC1B;QACH,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,SAAS,SAAS,EAAE;QAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,GAAmD,CAAC;IACnE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;IACpD,OAAO,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAAO,GAIH,EAAE;IAEN,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC;IACrD,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,UAAU,EAAE,CAAC,EAAE,CAAC;QACjD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACpC,qEAAqE;gBACrE,2CAA2C;gBAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,6BAA6B,WAAW,GAAG,CAAC,CAAC;gBAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,WAAW,GAAG,CAAC,CAAC;gBAC5D,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,qEAAqE;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Guards for on-demand `ensureTable()` DDL so the common already-migrated path\n * takes NO `ACCESS EXCLUSIVE` lock on Postgres.\n *\n * Lives in its own module (like `./widen-columns.js`) so stores can import it\n * without every `vi.mock(\"../db/client.js\")` test needing to stub it: the\n * helpers resolve `isPostgres()` / `getDbExec()` through `client.js`, so a test\n * that mocks the client to SQLite (`isPostgres: () => false`) makes the\n * Postgres-only existence checks no-ops automatically.\n *\n * ## Why\n *\n * `ensureTable()` runs once per process on first DB touch. In a long-lived Node\n * server the cost is paid once and is invisible. In a Netlify `-background`\n * function the process is fresh, so this is the FIRST touch — and the\n * `CREATE TABLE`/`ALTER TABLE ... ADD COLUMN` DDL it issues takes an\n * `ACCESS EXCLUSIVE` lock on the shared Neon Postgres database. Behind a\n * concurrent connection that already holds a conflicting lock, that DDL can\n * block ~indefinitely (observed >16s hangs in the bg worker vs ~1s inline).\n *\n * The tables/columns are essentially always already present in production, so\n * the DDL is redundant in the hot path. These helpers let a store cheaply check\n * `information_schema` first and only issue DDL when something is actually\n * missing — and when DDL must run, wrap it in a short `lock_timeout` so a\n * contended lock fails fast instead of hanging.\n *\n * All of this is Postgres-only behaviour gated on `isPostgres()`. On SQLite\n * (local dev) there is no such lock problem, so callers keep their existing\n * behaviour there.\n */\n\nimport { isPostgres, getDbExec, type DbExec } from \"./client.js\";\n\nconst PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n/**\n * True when running against Postgres AND the given table already exists in the\n * `public` schema. Returns `false` on SQLite (callers gate their own behaviour\n * there), for invalid identifiers, or when `information_schema` is unreadable —\n * the conservative answer \"not known to exist\" makes the caller fall through to\n * its idempotent `CREATE TABLE IF NOT EXISTS`, preserving today's behaviour.\n *\n * This is a plain read (no lock), so it never blocks on an `ACCESS EXCLUSIVE`\n * lock the way `CREATE`/`ALTER` would.\n */\nexport async function pgTableExists(\n  table: string,\n  injectedClient?: DbExec,\n  dialectIsPostgres?: boolean,\n): Promise<boolean> {\n  // The dialect override travels with an injected client: a multi-app process\n  // (the hosted Realtime Gateway) probes a per-app Postgres DB even when its\n  // own process-global DB is absent or SQLite.\n  if (!(dialectIsPostgres ?? isPostgres()) || !PLAIN_IDENTIFIER.test(table)) {\n    return false;\n  }\n  const client = injectedClient ?? getDbExec();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT 1 FROM information_schema.tables\n            WHERE table_schema = 'public' AND table_name = ? LIMIT 1`,\n      args: [table],\n    });\n    return rows.length > 0;\n  } catch {\n    // information_schema unreadable (permissions / non-standard backend) —\n    // report \"unknown\" so the caller falls back to IF NOT EXISTS.\n    return false;\n  }\n}\n\n/**\n * True when running against Postgres AND the given column already exists on the\n * given table in the `public` schema. Returns `false` on SQLite, for invalid\n * identifiers, or when `information_schema` is unreadable.\n *\n * Plain read — no lock taken.\n */\nexport async function pgColumnExists(\n  table: string,\n  column: string,\n  injectedClient?: DbExec,\n): Promise<boolean> {\n  if (!isPostgres()) return false;\n  if (!PLAIN_IDENTIFIER.test(table) || !PLAIN_IDENTIFIER.test(column)) {\n    return false;\n  }\n  const client = injectedClient ?? getDbExec();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT 1 FROM information_schema.columns\n            WHERE table_schema = 'public' AND table_name = ? AND column_name = ?\n            LIMIT 1`,\n      args: [table, column],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * True when running against Postgres AND an index with the given name already\n * exists in the `public` schema. Returns `false` on SQLite, for invalid\n * identifiers, or when `pg_indexes` is unreadable.\n *\n * `CREATE INDEX` (without CONCURRENTLY) takes a `SHARE` lock that blocks\n * writes, so on a fresh background-worker process behind a concurrent\n * connection this can hang just like a `CREATE`/`ALTER` would; checking first\n * skips the lock on the already-migrated hot path.\n */\nexport async function pgIndexExists(\n  indexName: string,\n  injectedClient?: DbExec,\n  dialectIsPostgres?: boolean,\n): Promise<boolean> {\n  if (\n    !(dialectIsPostgres ?? isPostgres()) ||\n    !PLAIN_IDENTIFIER.test(indexName)\n  ) {\n    return false;\n  }\n  const client = injectedClient ?? getDbExec();\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT 1 FROM pg_indexes\n            WHERE schemaname = 'public' AND indexname = ? LIMIT 1`,\n      args: [indexName],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Probe → guarded-DDL → re-probe sequence for one piece of on-demand schema.\n *\n * This is the single safe primitive every `ensureTable()` should use so a\n * swallowed `lock_timeout` can NEVER poison a store's init memo with missing\n * schema. The flow:\n *\n *   1. `probe()` — cheap, lock-free existence check (pgTableExists / etc.).\n *      Already present → return `false` (nothing to do; the hot path takes NO\n *      lock).\n *   2. Missing → run `ddl` through `runGuardedDdl` (bounded `lock_timeout`).\n *      - DDL completed → return `true`.\n *      - DDL was swallowed by a lock-timeout (`runGuardedDdl` returned `false`)\n *        → RE-PROBE. A concurrent connection virtually always created the\n *        object meanwhile, so the re-probe usually now reports it present →\n *        return `true`. But if it is STILL missing, the required schema does\n *        NOT exist and we must NOT let the caller memoize success — so THROW.\n *        The caller's `_initPromise` rejects and the next call retries instead\n *        of running forever against absent schema.\n *\n * On SQLite the probe is always `false` (helpers no-op there) and the SQLite\n * branch of each store keeps its own create-then-catch behaviour, so this is a\n * Postgres-path primitive in practice. Returns `true` when the object exists\n * after this call (either pre-existing-after-timeout-race or freshly created),\n * `false` only when it already existed up front (no DDL issued).\n */\nexport async function ensureSchemaObject(options: {\n  /** Lock-free existence check; `true` ⇒ already present, skip DDL. */\n  probe: () => Promise<boolean>;\n  /** DDL to run only when `probe()` reports the object missing. */\n  ddl: string;\n  /** Human-readable name of what's being ensured, for the error message. */\n  label: string;\n  /** Forwarded to `runGuardedDdl`. */\n  lockTimeout?: string;\n  /** Injectable client for tests. */\n  injectedClient?: DbExec;\n  /** Dialect override for injected per-app clients; defaults to the global. */\n  dialectIsPostgres?: boolean;\n}): Promise<boolean> {\n  const { probe, ddl, label, lockTimeout, injectedClient, dialectIsPostgres } =\n    options;\n  if (await probe()) return false;\n  const ran = await runGuardedDdl(ddl, {\n    lockTimeout,\n    injectedClient,\n    dialectIsPostgres,\n  });\n  if (ran) return true;\n  // The DDL was swallowed by a lock-timeout. The object is virtually always\n  // already correct by the time a contended boot retries (a concurrent\n  // connection created it), so re-probe before giving up.\n  if (await probe()) return true;\n  // Still missing after a swallowed timeout: do NOT memoize success with absent\n  // schema. Throw so the caller's init promise rejects and the next call\n  // retries, rather than leaving ensureTable \"initialized\" against a table/\n  // column/index that does not exist.\n  throw new Error(\n    `ensureSchemaObject: required schema \"${label}\" is still missing after a ` +\n      `lock-timed-out DDL; refusing to memoize init success. The next call will retry.`,\n  );\n}\n\n/**\n * Convenience wrapper: ensure a TABLE exists (probe via `pgTableExists`).\n * No-op-returns `false` on SQLite (probe is always false there) — callers run\n * the SQLite create on their own branch, so this is used on the Postgres path.\n */\nexport async function ensureTableExists(\n  table: string,\n  createSql: string,\n  options: {\n    lockTimeout?: string;\n    injectedClient?: DbExec;\n    dialectIsPostgres?: boolean;\n  } = {},\n): Promise<boolean> {\n  return ensureSchemaObject({\n    probe: () =>\n      pgTableExists(table, options.injectedClient, options.dialectIsPostgres),\n    ddl: createSql,\n    label: `table ${table}`,\n    lockTimeout: options.lockTimeout,\n    injectedClient: options.injectedClient,\n    dialectIsPostgres: options.dialectIsPostgres,\n  });\n}\n\n/**\n * Convenience wrapper: ensure a COLUMN exists (probe via `pgColumnExists`).\n * `addColumnSql` should be the full `ALTER TABLE … ADD COLUMN IF NOT EXISTS …`.\n */\nexport async function ensureColumnExists(\n  table: string,\n  column: string,\n  addColumnSql: string,\n  options: { lockTimeout?: string; injectedClient?: DbExec } = {},\n): Promise<boolean> {\n  return ensureSchemaObject({\n    probe: () => pgColumnExists(table, column, options.injectedClient),\n    ddl: addColumnSql,\n    label: `column ${table}.${column}`,\n    lockTimeout: options.lockTimeout,\n    injectedClient: options.injectedClient,\n  });\n}\n\n/**\n * Convenience wrapper: ensure an INDEX exists (probe via `pgIndexExists`).\n * `createIndexSql` should be the full `CREATE INDEX IF NOT EXISTS <name> …`.\n */\nexport async function ensureIndexExists(\n  indexName: string,\n  createIndexSql: string,\n  options: {\n    lockTimeout?: string;\n    injectedClient?: DbExec;\n    dialectIsPostgres?: boolean;\n  } = {},\n): Promise<boolean> {\n  return ensureSchemaObject({\n    probe: () =>\n      pgIndexExists(\n        indexName,\n        options.injectedClient,\n        options.dialectIsPostgres,\n      ),\n    ddl: createIndexSql,\n    label: `index ${indexName}`,\n    lockTimeout: options.lockTimeout,\n    injectedClient: options.injectedClient,\n    dialectIsPostgres: options.dialectIsPostgres,\n  });\n}\n\n/** True when an error looks like a Postgres `lock_timeout` (SQLSTATE 55P03). */\nexport function isLockTimeoutError(err: unknown): boolean {\n  const anyErr = err as { code?: unknown; message?: unknown } | null;\n  if (anyErr?.code === \"55P03\") return true;\n  const msg = String(anyErr?.message ?? anyErr ?? \"\");\n  return /lock[_ ]?timeout|canceling statement due to lock timeout/i.test(msg);\n}\n\n/**\n * Run a DDL statement that MUST execute (the schema is actually missing), with\n * a short `lock_timeout` so a contended `ACCESS EXCLUSIVE` lock fails fast\n * instead of hanging the whole process.\n *\n * Postgres path: wrap the DDL in an explicit transaction and set\n * `SET LOCAL lock_timeout` so the timeout is scoped to THIS transaction only\n * and reset automatically on COMMIT/ROLLBACK — it never leaks onto the pooled\n * (session-reused) connection the way a bare `SET lock_timeout` would. If the\n * DbExec has no `transaction` (shouldn't happen for Postgres, but defensively),\n * fall back to a session `SET` + `RESET` in a finally. A lock-timeout error is\n * swallowed: the table/column is virtually always already correct by the time a\n * contended boot retries, and the caller's memoization should still resolve so\n * the path isn't retried in a tight loop. Any non-lock-timeout error rethrows.\n *\n * SQLite path: no lock problem — just run the DDL directly.\n *\n * @returns `true` if the DDL ran to completion, `false` if it was skipped due to\n *          a lock-timeout (so the caller can decide whether to log).\n */\nexport async function runGuardedDdl(\n  ddl: string,\n  options: {\n    lockTimeout?: string;\n    injectedClient?: DbExec;\n    dialectIsPostgres?: boolean;\n  } = {},\n): Promise<boolean> {\n  const client = options.injectedClient ?? getDbExec();\n  if (!(options.dialectIsPostgres ?? isPostgres())) {\n    await client.execute(ddl);\n    return true;\n  }\n\n  const lockTimeout = options.lockTimeout ?? \"3s\";\n  try {\n    if (typeof client.transaction === \"function\") {\n      await client.transaction(async (tx) => {\n        // SET LOCAL is transaction-scoped: it reverts on COMMIT/ROLLBACK and\n        // never persists on the pooled connection.\n        await tx.execute(`SET LOCAL lock_timeout = '${lockTimeout}'`);\n        await tx.execute(ddl);\n      });\n    } else {\n      // Defensive fallback: no transaction support. Use a session SET and\n      // guarantee a RESET so the timeout never leaks onto a reused connection.\n      try {\n        await client.execute(`SET lock_timeout = '${lockTimeout}'`);\n        await client.execute(ddl);\n      } finally {\n        await client.execute(`RESET lock_timeout`).catch(() => {});\n      }\n    }\n    return true;\n  } catch (err) {\n    if (isLockTimeoutError(err)) {\n      // Contended lock — the schema is virtually always already correct by now.\n      // Proceed; the caller's memoization still resolves so we don't loop.\n      return false;\n    }\n    throw err;\n  }\n}\n"]}

package/dist/deploy/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/deploy/build.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAuCH,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAI7B,eAAO,MAAM,6BAA6B,UAiBzC,CAAC;AAEF,eAAO,MAAM,mCAAmC,UAiB/C,CAAC;AACF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyFjE,CAAC;AAEF,eAAO,MAAM,sCAAsC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAQzE,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAWvE;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,IAAI,CAgBN;AA6BD,eAAO,MAAM,2CAA2C,EAAE,MAAM,CAC9D,MAAM,EACN,MAAM,CAmSP,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,UAAU,wBAAwB;IAChC,KAAK,EAAE,6BAA6B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,6BAA6B;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,UAAU,6BAA6B;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAwBD,wBAAgB,wCAAwC,CACtD,WAAW,EAAE,MAAM,EAAE,GACpB,MAAM,CAaR;AAgBD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAgBvE,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,WAAW,SAAK,GACf,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EAAE,EACzB,WAAW,EAAE,MAAM,EAAE,EACrB,kBAAkB,GAAE,MAAM,EAAO,EACjC,OAAO,GAAE,gBAAgB,EAAO,EAChC,aAAa,GAAE,oBAAoB,GAAG,IAAW,EACjD,mBAAmB,GAAE,MAAM,EAAO,EAClC,gBAAgB,SAAmC,EACnD,OAAO,GAAE,0BAA+B,GACvC,MAAM,CA4pBR;AA4FD,wBAAgB,8CAA8C,CAC5D,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,SAAmC,GAC1C,MAAM,CAiCR;AAqeD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AA+GD,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,iBAAiB,cAAoB,QAoCtC;AAiCD,KAAK,0BAA0B,GAAG,OAAO,GAAG,KAAK,CAAC;AAQlD,wBAAgB,qCAAqC,CACnD,YAAY,GAAE,MAAM,CAAC,QAA2B,EAChD,QAAQ,GAAE,MAAM,CAAC,YAA2B,EAC5C,UAAU,GAAE,0BAA0B,GAAG,IAAgD,GACxF,OAAO,CAOT;AAqED,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,MAAM,EAAE,GACzB,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,IAAI,OAAO,CAK1D;AAID;;;;;GAKG;AACH,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,MAAM,GACjB,IAAI,CAiEN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,2CAA2C,CACzD,UAAU,EAAE,MAAM,GACjB,IAAI,CAkJN;AA8DD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAyDV;AAED,wBAAgB,sCAAsC,CACpD,UAAU,EAAE,MAAM,GACjB,IAAI,CAiNN;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAsC5E;AAuED;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CACvD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAqDN;AA6ID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,GAAG,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAkBD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,YAAI,KAAK,CAAU,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAQpD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GACnB,IAAI,GAAG,SAAS,MAAM,EAAE,CAS1B"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/deploy/build.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAuCH,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAI7B,eAAO,MAAM,6BAA6B,UAiBzC,CAAC;AAEF,eAAO,MAAM,mCAAmC,UAiB/C,CAAC;AACF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyFjE,CAAC;AAEF,eAAO,MAAM,sCAAsC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAQzE,CAAC;AAEF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAWvE;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,IAAI,CAgBN;AA6BD,eAAO,MAAM,2CAA2C,EAAE,MAAM,CAC9D,MAAM,EACN,MAAM,CAmSP,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,UAAU,wBAAwB;IAChC,KAAK,EAAE,6BAA6B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,6BAA6B;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,UAAU,6BAA6B;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAwBD,wBAAgB,wCAAwC,CACtD,WAAW,EAAE,MAAM,EAAE,GACpB,MAAM,CAaR;AAgBD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAgBvE,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,WAAW,SAAK,GACf,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EAAE,EACzB,WAAW,EAAE,MAAM,EAAE,EACrB,kBAAkB,GAAE,MAAM,EAAO,EACjC,OAAO,GAAE,gBAAgB,EAAO,EAChC,aAAa,GAAE,oBAAoB,GAAG,IAAW,EACjD,mBAAmB,GAAE,MAAM,EAAO,EAClC,gBAAgB,SAAmC,EACnD,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAmrBR;AA4FD,wBAAgB,8CAA8C,CAC5D,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,SAAmC,GAC1C,MAAM,CAiCR;AAqeD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AA+GD,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,iBAAiB,cAAoB,QAoCtC;AAiCD,KAAK,0BAA0B,GAAG,OAAO,GAAG,KAAK,CAAC;AAQlD,wBAAgB,qCAAqC,CACnD,YAAY,GAAE,MAAM,CAAC,QAA2B,EAChD,QAAQ,GAAE,MAAM,CAAC,YAA2B,EAC5C,UAAU,GAAE,0BAA0B,GAAG,IAAgD,GACxF,OAAO,CAOT;AAqED,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,MAAM,EAAE,GACzB,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,IAAI,OAAO,CAK1D;AAID;;;;;GAKG;AACH,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,MAAM,GACjB,IAAI,CAiEN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,2CAA2C,CACzD,UAAU,EAAE,MAAM,GACjB,IAAI,CAkJN;AA8DD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAyDV;AAED,wBAAgB,sCAAsC,CACpD,UAAU,EAAE,MAAM,GACjB,IAAI,CAiNN;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAsC5E;AAuED;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CACvD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAqDN;AA6ID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,GAAG,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAkBD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,YAAI,KAAK,CAAU,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAQpD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GACnB,IAAI,GAAG,SAAS,MAAM,EAAE,CAS1B"}

package/dist/deploy/build.js

@@ -770,6 +770,26 @@ function getSentryClientConfigScript() {
   );
 }
 
+function getRealtimeClientConfigScript() {
+  // MUST stay byte-for-byte consistent with resolveRealtimeClientConfig in
+  // server/sentry-config.ts (worker bundles a string copy; it can't import it).
+  // Fail closed: require BOTH hosted transport AND an explicit gateway URL — no
+  // production default, since this ships into the CDN-cached shell.
+  const env = globalThis.process?.env || {};
+  if (firstNonEmpty(env.AGENT_NATIVE_REALTIME_TRANSPORT) !== "hosted") {
+    return null;
+  }
+  const gatewayBaseUrl = firstNonEmpty(env.AGENT_NATIVE_REALTIME_GATEWAY_URL);
+  if (!gatewayBaseUrl) return null;
+  const config = { realtime: { transport: "hosted", gatewayBaseUrl } };
+  return (
+    '<script data-agent-native-realtime-config>' +
+    'window.__AGENT_NATIVE_CONFIG__=Object.assign({},window.__AGENT_NATIVE_CONFIG__,' +
+    JSON.stringify(config) +
+    ");</script>"
+  );
+}
+
 function injectHeadScript(html, script) {
   if (!script) return html;
   const headCloseIdx = html.indexOf("</head>");
@@ -907,7 +927,10 @@ function applyImmutableAssetCacheHeaders(response, request) {
 }
 
 async function rewriteMountedResponse(response, basePath, pathname, request) {
-  const sentryClientConfigScript = getSentryClientConfigScript();
+  const clientConfigScript =
+    [getSentryClientConfigScript(), getRealtimeClientConfigScript()]
+      .filter(Boolean)
+      .join("") || null;
   const headers = new Headers(response.headers);
   applyDefaultSsrCacheHeader(headers, response.status, pathname);
   applyDefaultSpeculationRulesHeader(headers, response.status, basePath);
@@ -934,7 +957,7 @@ async function rewriteMountedResponse(response, basePath, pathname, request) {
         prefixMountedHtml(html, basePath),
         defaultSocialImageUrl(request, basePath),
       ),
-      sentryClientConfigScript,
+      clientConfigScript,
     ),
     {
       status: response.status,